package com.iiifi.kite.xss.core;

import java.beans.PropertyEditorSupport;

import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.InitBinder;

import com.iiifi.kite.core.util.StringPool;
import com.iiifi.kite.xss.utils.XssUtil;

import lombok.extern.slf4j.Slf4j;

/**
 * 表单 xss 处理
 *
 * @author kite@iiifi.com 花朝
 */
@ControllerAdvice
public class FormXssClean {

    @InitBinder
    public void initBinder(WebDataBinder binder) {
        // 处理前端传来的表单字符串
        binder.registerCustomEditor(String.class, new StringPropertiesEditor());
    }

    @Slf4j
    public static class StringPropertiesEditor extends PropertyEditorSupport {

        @Override
        public String getAsText() {
            Object value = getValue();
            return value != null ? value.toString() : StringPool.EMPTY;
        }

        @Override
        public void setAsText(String text) throws IllegalArgumentException {
            if (text == null) {
                setValue(null);
            } else if (XssHolder.isEnabled()) {
                String value = XssUtil.clean(text);
                setValue(value);
                log.warn("Request parameter value:{} cleaned up by mica-xss, current value is:{}.", text, value);
            } else {
                setValue(text);
            }
        }
    }
}
